CND (312-38) Network Defense Simulation

Learn to evaluate data backup strategies based on availability and security requirements. This scenario focuses on selecting the appropriate Disaster Recovery (DR) method for ubiquitous, encrypted access.

Network Scenario

The organization's IT Steering Committee is restructuring its Business Continuity and Disaster Recovery (BCDR) strategy. With a newly distributed workforce operating globally, traditional centralized backups are causing availability bottlenecks.

The CISO has mandated a new backup architecture. The primary requirements are: the data must be strongly encrypted at rest and in transit, and it must be highly available so that remote employees can recover their files 24/7 without needing to route through the corporate VPN.

Traffic & Logs

# BCDR Policy Requirement Matrix v2.1

[REQ-01] Data Security: AES-256 Encryption at Rest.
[REQ-02] Transit Security: TLS 1.3 required for all sync operations.
[REQ-03] Accessibility: Internet-routable, ubiquitous access independent of HQ network state.

# Firewall Egress Log - Backup Sync Validation

Question

A company wants to implement a data backup method that allows them to encrypt the data ensuring its security as well as access it at any time and from any location. What is the appropriate backup method that should be implemented?

Expert Analysis

1. What is happening in the network

The organization is shifting from traditional localized backups to a decentralized model. The firewall logs demonstrate geographically disparate endpoints establishing encrypted connections (TLS 1.3 over port 443) directly to an Internet-routable storage bucket (e.g., AWS S3).

2. Identify the DR Behavior

This is a characteristic **Cloud Backup** implementation. The data is synchronized over the internet to a Cloud Service Provider (CSP) which handles the infrastructure, availability, and encryption at rest natively.

3. Why Correct (A) is Correct

Cloud backup utilizes internet infrastructure to ensure data is accessible from any location at any time. Modern cloud storage solutions offer robust built-in encryption protocols (such as AES-256 for data at rest and TLS for data in transit), perfectly satisfying all the conditions in the prompt.

4. Why others are wrong

Offsite backup: While cloud is technically offsite, traditional offsite backup often refers to physical media (tape/disk) stored at a secondary location. This does not provide immediate "anytime/anywhere" network access.
Hot site backup: A hot site is an alternate processing facility equipped with hardware and data, meant for taking over operations during a disaster. It is a recovery facility, not just a data backup method for users.
Onsite backup: Local backups (NAS, SAN, local tapes) are highly vulnerable to localized disasters and are not natively accessible from "any location" without complex VPN/routing setups.

5. Defensive Action

When relying on cloud backups, Network Defenders must secure the perimeter through strong Identity and Access Management (IAM). Implement Multi-Factor Authentication (MFA) for access, enforce strict bucket policies to prevent public exposure, and utilize Customer Managed Keys (CMKs) to ensure the organization maintains absolute control over data encryption.

MINI LESSON: The 3-2-1 Backup Rule & Encryption

A robust defense-in-depth DR strategy relies on the 3-2-1 rule:

3 Copies of your data (1 primary, 2 backups).
2 Different media types (e.g., local disk + cloud storage).
1 Copy offsite (Cloud storage fulfills this).

Note: In a cloud context, transit encryption (TLS) protects against MITM attacks, while at-rest encryption protects against physical theft of CSP hard drives or misconfigured public buckets.

Explore more CND simulations

Go to Practice Tests